FortiDDos DDoS Attack Mitigation Guide - Fortinet

Attacks to test functionality and performance
Anomalous state floods
Protocols such as TCP are stateful. They follow predefined state transition rules. When
scripted bots generate attacks, they violate many of these rules. Examples of such
attacks are ACK packets coming without connection establishment, out of TCP
window packets etc.
Limited sources versus large number of sources floods
Some DDoS attacks are launched using very limited number of sources while some
others are launched with a very large number of sources. It is easy to launch a spoofed
attack with a seemingly large number of sources. To launch a non-spoofed large
number source attack, you need a control over a large botnet.
Layer 3, 4 or 7 DDoS attack
It is possible to launch DDoS attacks on different network layers.
Over the Internet, one can launch Layer 3, 4 or 7 attacks.
Example of Layer 3 attacks are protocol floods such as ICMP floods, TCP floods,
fragment floods. These are created using a variation in the layer 3 headers.
Example of layer 4 floods are port floods (TCP or UDP). In these attacks, a single port
is continuously attacked. ICMP echo flood are also of this kind.
Example of layer 7 floods are URL floods. In this attack, a single URL is continuously
attacked from multiple sources.
Random header parameter attack
It is easy to create DDoS attacks in which some specific header parameter is
continuously varying. Examples are TCP random flag flooding, IP option flooding, TCP
option flooding etc.
Blended attack
It is easy to create DDoS attacks in which many attacks are combined to further
confuse the destination. Examples are port floods on TCP and UDP simultaneously.
Attacks to test functionality and performance
Spoofed syn flood attack
This is a layer 4 spoofed flood in which the attacker sends TCP SYN packets in which
the IP addresses are continuously changing.
FortiDDoS DDoS Attack Mitigation Guide
28-100-167076-20120501 27
http://docs.fortinet.com/ • Feedback